Rule scope?

[mvevitsis]

With these:

Allow broadcasts on internal interface

pass from any to 255.255.255.255 keep state
pass from 255.255.255.255 to any keep state

Allow multicast

pass proto udp from any to 224.0.0.0/4 keep state
pass proto udp from 224.0.0.0/4 to any keep state

Aren't you technically allowing broadcasts over the VPN interface?

Shouldn't it be something like
pass on $int_if from any to 255.255.255.255 keep state

Or even
pass on $int_if from $my_subnet to 255.255.255.255 keep state

Likewise, the LAN rule enabled with -local doesn't specify the hardware interface:

pass from $subnet to $subnet keep state

Shouldn't this be:

pass on $int-if from $subnet to $subnet

[nbari]

Hi @mvevitsis, it is already there https://github.com/vpn-kill-switch/killswitch/blob/master/pf.go#L45-L46